Skip to content

Commit 91c7fb4

Browse files
csantanaprcsantanapr
committed
private git repo example
Signed-off-by: Carlos Santana <csantana23@gmail.com>
1 parent ee79fcc commit 91c7fb4

File tree

10 files changed

+438
-0
lines changed

10 files changed

+438
-0
lines changed

‎argocd/iac/terraform/examples/eks/external-secrets/README.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# ArgoCD on Amazon EKS
2+
3+
This example shows how to deploy Amazon EKS with addons configured via ArgoCD
4+
5+
The example demonstrate how to use private git repository for workload apps
6+
7+
Create a secret with name `github-ssh-key` and the content in plain text of git private ssh key
8+
9+
Deploy EKS Cluster
10+
```shell
11+
terraform init
12+
terraform apply
13+
```
14+
15+
Access Terraform output to configure `kubectl` and `argocd`
16+
```shell
17+
terraform output
18+
```
19+
20+
Destroy EKS Cluster
21+
```shell
22+
cd hub
23+
./destroy.sh
24+
```

‎argocd/iac/terraform/examples/eks/external-secrets/bootstrap/addons.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: bootstrap-addons
5+
namespace: 'argocd'
6+
spec:
7+
destination:
8+
server: https://kubernetes.default.svc
9+
namespace: 'argocd'
10+
project: default
11+
source:
12+
path: bootstrap/control-plane/addons
13+
repoURL: https://github.com/gitops-bridge-dev/gitops-bridge-argocd-control-plane-template
14+
targetRevision: HEAD
15+
directory:
16+
recurse: true
17+
exclude: exclude/*
18+
syncPolicy:
19+
automated: {}

‎argocd/iac/terraform/examples/eks/external-secrets/bootstrap/workloads.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: bootstrap-workloads
5+
namespace: argocd
6+
finalizers:
7+
- resources-finalizer.argocd.argoproj.io
8+
spec:
9+
destination:
10+
namespace: default
11+
server: https://kubernetes.default.svc
12+
project: default
13+
source:
14+
path: envs/dev
15+
repoURL: git@github.com:aws-samples/eks-blueprints-workloads.git
16+
targetRevision: HEAD
17+
syncPolicy:
18+
syncOptions:
19+
- CreateNamespace=true

‎argocd/iac/terraform/examples/eks/external-secrets/destroy.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/bin/bash
2+
3+
set -x
4+
5+
# Delete the Ingress/SVC before removing the addons
6+
TMPFILE=$(mktemp)
7+
terraform output -raw configure_kubectl > "$TMPFILE"
8+
source "$TMPFILE"
9+
10+
kubectl delete svc -n argocd argo-cd-argocd-server
11+
12+
terraform destroy -target="module.gitops_bridge_bootstrap" -auto-approve
13+
terraform destroy -target="module.eks_blueprints_addons" -auto-approve
14+
terraform destroy -target="module.eks" -auto-approve
15+
terraform destroy -target="module.vpc" -auto-approve
16+
terraform destroy -auto-approve

‎argocd/iac/terraform/examples/eks/external-secrets/main.tf‎

Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
provider "aws" {
2+
region = local.region
3+
}
4+
data "aws_caller_identity" "current" {}
5+
data "aws_availability_zones" "available" {}
6+
7+
provider "helm" {
8+
kubernetes {
9+
host = module.eks.cluster_endpoint
10+
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
11+
12+
exec {
13+
api_version = "client.authentication.k8s.io/v1beta1"
14+
command = "aws"
15+
# This requires the awscli to be installed locally where Terraform is executed
16+
args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", local.region]
17+
}
18+
}
19+
}
20+
21+
provider "kubectl" {
22+
host = module.eks.cluster_endpoint
23+
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
24+
exec {
25+
api_version = "client.authentication.k8s.io/v1beta1"
26+
args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", local.region]
27+
command = "aws"
28+
}
29+
load_config_file = false
30+
apply_retry_count = 15
31+
}
32+
33+
provider "kubernetes" {
34+
host = module.eks.cluster_endpoint
35+
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
36+
37+
exec {
38+
api_version = "client.authentication.k8s.io/v1beta1"
39+
command = "aws"
40+
# This requires the awscli to be installed locally where Terraform is executed
41+
args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name, "--region", local.region]
42+
}
43+
}
44+
45+
locals {
46+
name = "ex-${replace(basename(path.cwd), "_", "-")}"
47+
environment = "dev"
48+
region = "us-west-2"
49+
cluster_version = "1.27"
50+
51+
aws_secret_manager_secret_name = "github-ssh-key"
52+
53+
aws_addons = {
54+
enable_cert_manager = true
55+
#enable_aws_efs_csi_driver = true
56+
#enable_aws_fsx_csi_driver = true
57+
#enable_aws_cloudwatch_metrics = true
58+
#enable_aws_privateca_issuer = true
59+
#enable_cluster_autoscaler = true
60+
#enable_external_dns = true
61+
enable_external_secrets = true
62+
#enable_aws_load_balancer_controller = true
63+
#enable_fargate_fluentbit = true
64+
#enable_aws_for_fluentbit = true
65+
#enable_aws_node_termination_handler = true
66+
#enable_karpenter = true
67+
#enable_velero = true
68+
#enable_aws_gateway_api_controller = true
69+
#enable_aws_ebs_csi_resources = true # generate gp2 and gp3 storage classes for ebs-csi
70+
#enable_aws_secrets_store_csi_driver_provider = true
71+
}
72+
oss_addons = {
73+
#enable_argo_rollouts = true
74+
#enable_argo_workflows = true
75+
#enable_cluster_proportional_autoscaler = true
76+
#enable_gatekeeper = true
77+
#enable_gpu_operator = true
78+
#enable_ingress_nginx = true
79+
#enable_kyverno = true
80+
#enable_kube_prometheus_stack = true
81+
enable_metrics_server = true
82+
#enable_prometheus_adapter = true
83+
#enable_secrets_store_csi_driver = true
84+
#enable_vpa = true
85+
#enable_foo = true # you can add any addon here, make sure to update the gitops repo with the corresponding application set
86+
}
87+
addons = merge(local.aws_addons, local.oss_addons, { kubernetes_version = local.cluster_version })
88+
89+
addons_metadata = merge(
90+
module.eks_blueprints_addons.gitops_metadata,
91+
{
92+
aws_cluster_name = module.eks.cluster_name
93+
aws_region = local.region
94+
aws_account_id = data.aws_caller_identity.current.account_id
95+
aws_vpc_id = module.vpc.vpc_id
96+
}
97+
)
98+
99+
argocd_bootstrap_app_of_apps = {
100+
addons = file("${path.module}/bootstrap/addons.yaml")
101+
workloads = file("${path.module}/bootstrap/workloads.yaml")
102+
}
103+
104+
vpc_cidr = "10.0.0.0/16"
105+
azs = slice(data.aws_availability_zones.available.names, 0, 3)
106+
107+
tags = {
108+
Blueprint = local.name
109+
GithubRepo = "github.com/csantanapr/terraform-gitops-bridge"
110+
}
111+
}
112+
113+
################################################################################
114+
# GitOps Bridge: Metadata
115+
################################################################################
116+
module "gitops_bridge_metadata" {
117+
source = "../../../modules/gitops-bridge-metadata"
118+
119+
cluster_name = module.eks.cluster_name
120+
environment = local.environment
121+
metadata = local.addons_metadata
122+
addons = local.addons
123+
}
124+
125+
################################################################################
126+
# GitOps Bridge: Bootstrap
127+
################################################################################
128+
module "gitops_bridge_bootstrap" {
129+
source = "../../../modules/gitops-bridge-bootstrap"
130+
131+
argocd_cluster = module.gitops_bridge_metadata.argocd
132+
argocd_bootstrap_app_of_apps = local.argocd_bootstrap_app_of_apps
133+
}
134+
135+
################################################################################
136+
# AWS Secret Manager
137+
################################################################################
138+
data "aws_secretsmanager_secret" "git_ssh_key" {
139+
name = local.aws_secret_manager_secret_name
140+
}
141+
142+
143+
################################################################################
144+
# EKS Blueprints Addons
145+
################################################################################
146+
module "eks_blueprints_addons" {
147+
source = "github.com/csantanapr/terraform-aws-eks-blueprints-addons?ref=gitops-bridge-v2"
148+
149+
cluster_name = module.eks.cluster_name
150+
cluster_endpoint = module.eks.cluster_endpoint
151+
cluster_version = module.eks.cluster_version
152+
oidc_provider_arn = module.eks.oidc_provider_arn
153+
154+
# Using GitOps Bridge
155+
create_kubernetes_resources = false
156+
157+
# EKS Blueprints Addons
158+
enable_cert_manager = try(local.aws_addons.enable_cert_manager, false)
159+
enable_aws_efs_csi_driver = try(local.aws_addons.enable_aws_efs_csi_driver, false)
160+
enable_aws_fsx_csi_driver = try(local.aws_addons.enable_aws_fsx_csi_driver, false)
161+
enable_aws_cloudwatch_metrics = try(local.aws_addons.enable_aws_cloudwatch_metrics, false)
162+
enable_aws_privateca_issuer = try(local.aws_addons.enable_aws_privateca_issuer, false)
163+
enable_cluster_autoscaler = try(local.aws_addons.enable_cluster_autoscaler, false)
164+
enable_external_dns = try(local.aws_addons.enable_external_dns, false)
165+
enable_external_secrets = try(local.aws_addons.enable_external_secrets, false)
166+
enable_aws_load_balancer_controller = try(local.aws_addons.enable_aws_load_balancer_controller, false)
167+
enable_fargate_fluentbit = try(local.aws_addons.enable_fargate_fluentbit, false)
168+
enable_aws_for_fluentbit = try(local.aws_addons.enable_aws_for_fluentbit, false)
169+
enable_aws_node_termination_handler = try(local.aws_addons.enable_aws_node_termination_handler, false)
170+
enable_karpenter = try(local.aws_addons.enable_karpenter, false)
171+
enable_velero = try(local.aws_addons.enable_velero, false)
172+
enable_aws_gateway_api_controller = try(local.aws_addons.enable_aws_gateway_api_controller, false)
173+
174+
tags = local.tags
175+
}
176+
177+
################################################################################
178+
# EKS Cluster
179+
################################################################################
180+
#tfsec:ignore:aws-eks-enable-control-plane-logging
181+
module "eks" {
182+
source = "terraform-aws-modules/eks/aws"
183+
version = "~> 19.13"
184+
185+
cluster_name = local.name
186+
cluster_version = local.cluster_version
187+
cluster_endpoint_public_access = true
188+
189+
190+
vpc_id = module.vpc.vpc_id
191+
subnet_ids = module.vpc.private_subnets
192+
193+
eks_managed_node_groups = {
194+
initial = {
195+
instance_types = ["t3.medium"]
196+
197+
min_size = 3
198+
max_size = 10
199+
desired_size = 3
200+
}
201+
}
202+
# EKS Addons
203+
cluster_addons = {
204+
vpc-cni = {
205+
# Specify the VPC CNI addon should be deployed before compute to ensure
206+
# the addon is configured before data plane compute resources are created
207+
# See README for further details
208+
before_compute = true
209+
most_recent = true # To ensure access to the latest settings provided
210+
configuration_values = jsonencode({
211+
env = {
212+
# Reference docs https://docs.aws.amazon.com/eks/latest/userguide/cni-increase-ip-addresses.html
213+
ENABLE_PREFIX_DELEGATION = "true"
214+
WARM_PREFIX_TARGET = "1"
215+
}
216+
})
217+
}
218+
}
219+
tags = local.tags
220+
}
221+
222+
################################################################################
223+
# Supporting Resources
224+
################################################################################
225+
module "vpc" {
226+
source = "terraform-aws-modules/vpc/aws"
227+
version = "~> 5.0"
228+
229+
name = local.name
230+
cidr = local.vpc_cidr
231+
232+
azs = local.azs
233+
private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 4, k)]
234+
public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 48)]
235+
236+
enable_nat_gateway = true
237+
single_nat_gateway = true
238+
239+
public_subnet_tags = {
240+
"kubernetes.io/role/elb" = 1
241+
}
242+
243+
private_subnet_tags = {
244+
"kubernetes.io/role/internal-elb" = 1
245+
}
246+
247+
tags = local.tags
248+
}

‎argocd/iac/terraform/examples/eks/external-secrets/outputs.tf‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
output "configure_kubectl" {
2+
description = "Configure kubectl: make sure you're logged in with the correct AWS profile and run the following command to update your kubeconfig"
3+
value = <<-EOT
4+
export KUBECONFIG="/tmp/${module.eks.cluster_name}"
5+
aws eks --region ${local.region} update-kubeconfig --name ${module.eks.cluster_name}
6+
EOT
7+
}
8+
9+
output "configure_argocd" {
10+
description = "Terminal Setup"
11+
value = <<-EOT
12+
export KUBECONFIG="/tmp/${module.eks.cluster_name}"
13+
aws eks --region ${local.region} update-kubeconfig --name ${module.eks.cluster_name}
14+
export ARGOCD_OPTS="--port-forward --port-forward-namespace argocd --grpc-web"
15+
kubectl config set-context --current --namespace argocd
16+
argocd login --port-forward --username admin --password $(argocd admin initial-password | head -1)
17+
echo "ArgoCD Username: admin"
18+
echo "ArgoCD Password: $(kubectl get secrets argocd-initial-admin-secret -n argocd --template="{{index .data.password | base64decode}}")"
19+
echo Port Forward: http://localhost:8080
20+
kubectl port-forward -n argocd svc/argo-cd-argocd-server 8080:80
21+
EOT
22+
}
23+
24+
output "access_argocd" {
25+
description = "ArgoCD Access"
26+
value = <<-EOT
27+
export KUBECONFIG="/tmp/${module.eks.cluster_name}"
28+
aws eks --region ${local.region} update-kubeconfig --name ${module.eks.cluster_name}
29+
echo "ArgoCD URL: https://$(kubectl get svc -n argocd argo-cd-argocd-server -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')"
30+
echo "ArgoCD Username: admin"
31+
echo "ArgoCD Password: $(kubectl get secrets argocd-initial-admin-secret -n argocd --template="{{index .data.password | base64decode}}")"
32+
EOT
33+
}

‎argocd/iac/terraform/examples/eks/external-secrets/secrets/argoapp.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: test-private-repo
5+
namespace: argocd
6+
spec:
7+
destination:
8+
namespace: default
9+
server: https://kubernetes.default.svc
10+
project: default
11+
source:
12+
path: envs/dev
13+
repoURL: git@github.com:aws-samples/eks-blueprints-workloads.git
14+
targetRevision: HEAD

0 commit comments

Comments
 (0)